BAS-IP AV-01D, AV-01MD, AV-01MFD, AV-01ED, AV-01KD, AV-01BD, AV-01KBD, AV-02D, AV-02IDE…
Priority MEDIUM 64CWE-256Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-256.
Summary
BAS-IP AV-01D, AV-01MD, AV-01MFD, AV-01ED, AV-01KD, AV-01BD, AV-01KBD, AV-02D, AV-02IDE, AV-02IDR, AV-02IPD, AV-02FDE, AV-02FDR, AV-03D, AV-03BD, AV-04AFD, AV-04ASD, AV-04FD, AV-04SD, AV-05FD, AV-05SD, AA-07BD, AA-07BDI, BA-04BD, BA-04MD, BA-08BD, BA-08MD, BA-12BD, BA-12MD, CR-02BD before firmware v3.9.2 allows authenticated attackers to read SIP account passwords via a crafted GET request.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0044 38th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE names CISA-ADP · 29
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:bas-ip:av-01d:*:*:*:*:*:*:*:* | — | — | — |
| cpe:2.3:a:bas-ip:av-01md:*:*:*:*:*:*:*:* | — | — | — |
| cpe:2.3:a:bas-ip:av-01mfd:*:*:*:*:*:*:*:* | — | — | — |
| cpe:2.3:a:bas-ip:av-01ed:*:*:*:*:*:*:*:* | — | — | — |
| cpe:2.3:a:bas-ip:av-01kd:*:*:*:*:*:*:*:* | — | — | — |
| cpe:2.3:a:bas-ip:av-01bd:*:*:*:*:*:*:*:* | — | — | — |
| cpe:2.3:a:bas-ip:av-02d:*:*:*:*:*:*:*:* | — | — | — |
| cpe:2.3:a:bas-ip:av-02ide:*:*:*:*:*:*:*:* | — | — | — |
| cpe:2.3:a:bas-ip:av-02idr:*:*:*:*:*:*:*:* | — | — | — |
| cpe:2.3:a:bas-ip:av-02ipd:*:*:*:*:*:*:*:* | — | — | — |
- cpe:2.3:a:bas-ip:av-01d:*:*:*:*:*:*:*:* Versions — — ·—
- cpe:2.3:a:bas-ip:av-01md:*:*:*:*:*:*:*:* Versions — — ·—
- cpe:2.3:a:bas-ip:av-01mfd:*:*:*:*:*:*:*:* Versions — — ·—
- cpe:2.3:a:bas-ip:av-01ed:*:*:*:*:*:*:*:* Versions — — ·—
- cpe:2.3:a:bas-ip:av-01kd:*:*:*:*:*:*:*:* Versions — — ·—
- cpe:2.3:a:bas-ip:av-01bd:*:*:*:*:*:*:*:* Versions — — ·—
- cpe:2.3:a:bas-ip:av-02d:*:*:*:*:*:*:*:* Versions — — ·—
- cpe:2.3:a:bas-ip:av-02ide:*:*:*:*:*:*:*:* Versions — — ·—
- cpe:2.3:a:bas-ip:av-02idr:*:*:*:*:*:*:*:* Versions — — ·—
- cpe:2.3:a:bas-ip:av-02ipd:*:*:*:*:*:*:*:* Versions — — ·—
Show 19 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:bas-ip:av-02fde:*:*:*:*:*:*:*:* | — | — | — |
| cpe:2.3:a:bas-ip:av-02fdr:*:*:*:*:*:*:*:* | — | — | — |
| cpe:2.3:a:bas-ip:av-03d:*:*:*:*:*:*:*:* | — | — | — |
| cpe:2.3:a:bas-ip:av-03bd:*:*:*:*:*:*:*:* | — | — | — |
| cpe:2.3:a:bas-ip:av-04afd:*:*:*:*:*:*:*:* | — | — | — |
| cpe:2.3:a:bas-ip:av-04asd:*:*:*:*:*:*:*:* | — | — | — |
| cpe:2.3:a:bas-ip:av-04fd:*:*:*:*:*:*:*:* | — | — | — |
| cpe:2.3:a:bas-ip:av-04sd:*:*:*:*:*:*:*:* | — | — | — |
| cpe:2.3:a:bas-ip:av-05fd:*:*:*:*:*:*:*:* | — | — | — |
| cpe:2.3:a:bas-ip:av-05sd:*:*:*:*:*:*:*:* | — | — | — |
| cpe:2.3:a:bas-ip:aa-07bd:*:*:*:*:*:*:*:* | — | — | — |
| cpe:2.3:a:bas-ip:aa-07bdi:*:*:*:*:*:*:*:* | — | — | — |
| cpe:2.3:a:bas-ip:ba-04bd:*:*:*:*:*:*:*:* | — | — | — |
| cpe:2.3:a:bas-ip:ba-04md:*:*:*:*:*:*:*:* | — | — | — |
| cpe:2.3:a:bas-ip:ba-08bd:*:*:*:*:*:*:*:* | — | — | — |
| cpe:2.3:a:bas-ip:ba-08md:*:*:*:*:*:*:*:* | — | — | — |
| cpe:2.3:a:bas-ip:ba-12bd:*:*:*:*:*:*:*:* | — | — | — |
| cpe:2.3:a:bas-ip:ba-12md:*:*:*:*:*:*:*:* | — | — | — |
| cpe:2.3:a:bas-ip:cr-02bd:*:*:*:*:*:*:*:* | — | — | — |
- cpe:2.3:a:bas-ip:av-02fde:*:*:*:*:*:*:*:* Versions — — ·—
- cpe:2.3:a:bas-ip:av-02fdr:*:*:*:*:*:*:*:* Versions — — ·—
- cpe:2.3:a:bas-ip:av-03d:*:*:*:*:*:*:*:* Versions — — ·—
- cpe:2.3:a:bas-ip:av-03bd:*:*:*:*:*:*:*:* Versions — — ·—
- cpe:2.3:a:bas-ip:av-04afd:*:*:*:*:*:*:*:* Versions — — ·—
- cpe:2.3:a:bas-ip:av-04asd:*:*:*:*:*:*:*:* Versions — — ·—
- cpe:2.3:a:bas-ip:av-04fd:*:*:*:*:*:*:*:* Versions — — ·—
- cpe:2.3:a:bas-ip:av-04sd:*:*:*:*:*:*:*:* Versions — — ·—
- cpe:2.3:a:bas-ip:av-05fd:*:*:*:*:*:*:*:* Versions — — ·—
- cpe:2.3:a:bas-ip:av-05sd:*:*:*:*:*:*:*:* Versions — — ·—
- cpe:2.3:a:bas-ip:aa-07bd:*:*:*:*:*:*:*:* Versions — — ·—
- cpe:2.3:a:bas-ip:aa-07bdi:*:*:*:*:*:*:*:* Versions — — ·—
- cpe:2.3:a:bas-ip:ba-04bd:*:*:*:*:*:*:*:* Versions — — ·—
- cpe:2.3:a:bas-ip:ba-04md:*:*:*:*:*:*:*:* Versions — — ·—
- cpe:2.3:a:bas-ip:ba-08bd:*:*:*:*:*:*:*:* Versions — — ·—
- cpe:2.3:a:bas-ip:ba-08md:*:*:*:*:*:*:*:* Versions — — ·—
- cpe:2.3:a:bas-ip:ba-12bd:*:*:*:*:*:*:*:* Versions — — ·—
- cpe:2.3:a:bas-ip:ba-12md:*:*:*:*:*:*:*:* Versions — — ·—
- cpe:2.3:a:bas-ip:cr-02bd:*:*:*:*:*:*:*:* Versions — — ·—
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2024-39220
- 2026-10-03 Alias added: GHSA-pxvx-mm2m-59v4
Sources
- CVE-2024-39220 · CVE Program
- CVE-2024-39220 · NVD
- FIRST EPSS
- GHSA-pxvx-mm2m-59v4 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences